Privacy Policy

This Privacy Policy explains how Dave's Hot Chicken ("we," "us," "our," or the "Company") collects, uses, discloses, retains, and protects your personal information when you visit our website at daveshot-cafe.rest, place orders online, interact with our digital services, or otherwise engage with our business. We are committed to protecting your privacy and handling your personal data in a transparent, lawful, and responsible manner.

By accessing or using our website, services, or any features offered through daveshot-cafe.rest, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our services immediately.

We encourage you to review this Privacy Policy periodically, as we may update it from time to time to reflect changes in our practices, applicable laws, or operational requirements. We will notify you of material changes by posting a revised version on our website with an updated effective date.

1. About Us

Dave's Hot Chicken is a food service business operating in the United States. We specialize in serving delicious, high-quality hot chicken and related food items to our valued customers. Our contact details are as follows:

For any privacy-related questions, concerns, or requests, you may contact us directly at [email protected].

2. Scope of This Privacy Policy

This Privacy Policy applies to:

• All visitors to our website at daveshot-cafe.rest
• Customers who place food orders online or through any digital ordering platform we operate
• Individuals who sign up for our loyalty programs, newsletters, or promotional communications
• Individuals who contact us via email, phone, or any other communication channel
• Individuals who participate in our surveys, promotions, contests, or special events
• Job applicants who submit personal information in connection with employment inquiries

This policy does not apply to third-party websites, platforms, or services that may be linked to from our website. We are not responsible for the privacy practices of those third parties, and we encourage you to review their policies separately.

3. Information We Collect

We collect several categories of personal information depending on how you interact with our business. The types of data we collect are described in detail below.

3.1 Personal Information You Provide Directly

When you voluntarily interact with our website or services, you may provide us with personal information, including but not limited to:

• Contact Information: Your full name, email address, phone number, and mailing or delivery address.
• Account Information: Username, password, and account preferences if you create an account on our platform.
• Order Information: Details about your food orders, including items ordered, order history, special requests, and dietary preferences.
• Payment Information: Billing address, and payment card details. Note that payment card data is processed by our secure third-party payment processors and is not stored directly on our servers.
• Communications: Messages, inquiries, feedback, complaints, or any other information you send to us via email, contact forms, or customer support channels.
• Marketing Preferences: Your consent to receive promotional emails, SMS notifications, or other marketing communications, and your preferences regarding such communications.
• Loyalty Program Data: Points balance, redemption history, and participation in rewards or referral programs.

3.2 Information Collected Automatically

When you access and use our website, certain information is collected automatically through cookies, web beacons, log files, and similar tracking technologies, including:

• Device Information: Device type, operating system and version, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages viewed, time spent on pages, links clicked, features used, search queries entered, and navigation paths within our website.
• Log Data: Your IP address, internet service provider (ISP), referring and exit URLs, date and time of access, and error logs.
• Location Data: General geographic location derived from your IP address. We do not collect precise GPS-level location data unless you explicitly grant permission through your device settings.
• Cookie and Tracking Data: Data collected via cookies, pixel tags, and similar tracking technologies as described further in Section 8 of this policy.

3.3 Information from Third Parties

We may receive personal information about you from third-party sources, including:

• Social Media Platforms: If you connect a social media account (such as Facebook, Instagram, or Google) to log in or interact with our services, we may receive your public profile information, email address, and other data permitted by those platforms.
• Delivery and Ordering Partners: Third-party food delivery and ordering platforms that partner with us may share order and contact information necessary to fulfill your orders.
• Analytics Providers: Aggregated or de-identified analytics data from third-party analytics services.
• Marketing Partners: Lead generation or marketing partners who have obtained your consent to share your information with businesses like ours.

4. How We Use Your Information

We use the personal information we collect for the following purposes, in accordance with applicable United States law, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the Federal Trade Commission (FTC) Act:

4.1 Service Provision and Order Fulfillment

• Processing and fulfilling your food orders, including delivery and pickup arrangements
• Managing your account and providing customer support
• Communicating order confirmations, status updates, and receipts
• Handling refunds, complaints, or disputes related to your orders

4.2 Business Operations and Administration

• Maintaining accurate business records and internal accounting
• Preventing, detecting, and investigating fraud or unauthorized access
• Ensuring the security and integrity of our website and services
• Complying with applicable legal and regulatory obligations
• Enforcing our Terms of Service and other applicable agreements

4.3 Analytics and Service Improvement

• Analyzing website traffic and user behavior to understand how our services are used
• Improving the design, functionality, and performance of our website
• Identifying popular menu items, trends, and customer preferences
• Conducting internal research and business analytics to improve our products and services
• Troubleshooting technical issues and enhancing user experience

4.4 Marketing and Communications

• Sending promotional emails, newsletters, special offers, and announcements about new menu items or services, where you have consented or where permitted by applicable law
• Personalizing your experience on our website based on your preferences and order history
• Displaying targeted advertising on our website or third-party platforms, including social media
• Conducting surveys, contests, and promotional campaigns
• Administering loyalty programs and rewards

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any promotional email, by contacting us at [email protected], or by adjusting your account preferences. Opting out of marketing communications will not affect your receipt of transactional communications necessary for order fulfillment.

5. Legal Basis for Processing (Applicable Law)

As a food business operating in the United States, our data practices are governed primarily by:

• The California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA): Applicable if you are a California resident. This law grants California consumers specific rights regarding their personal information, including the right to know, delete, correct, and opt out of the sale or sharing of personal information.
• The Federal Trade Commission (FTC) Act: Prohibits unfair or deceptive acts or practices in commerce, including misrepresentations about our data practices.
• The CAN-SPAM Act: Governs our commercial email communications.
• The Children's Online Privacy Protection Act (COPPA): Protects the privacy of children under the age of 13 online.
• Other applicable federal and state privacy laws: Including the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), and other state-level privacy regulations as applicable to our customers.

We process your personal information on the following bases:

• Contract Performance: To fulfill your orders and provide the services you have requested.
• Legitimate Business Interests: For fraud prevention, security, analytics, and improvement of our services, where these interests are not overridden by your privacy rights.
• Consent: For marketing communications and non-essential cookies, where we have obtained your consent.
• Legal Obligation: To comply with applicable laws, court orders, or regulatory requirements.

6. Sharing Your Information with Third Parties

We do not sell your personal information to third parties in exchange for monetary compensation. However, we may share your information in the following circumstances:

6.1 Service Providers

We engage trusted third-party service providers to assist us in operating our business and delivering services to you. These providers are contractually obligated to protect your information and may only use it for the purposes we specify. Categories of service providers include:

• Payment processors (e.g., Stripe, Square, or similar platforms) for secure transaction processing
• Food delivery and logistics partners
• Email and SMS marketing platforms
• Website hosting and cloud infrastructure providers
• Analytics and measurement platforms (e.g., Google Analytics)
• Customer support software providers
• IT security and fraud prevention services

6.2 Business Transfers

If Dave's Hot Chicken is involved in a merger, acquisition, asset sale, reorganization, or bankruptcy proceeding, your personal information may be transferred as part of that transaction. We will notify you via prominent notice on our website or by email before your personal information is transferred and becomes subject to a different privacy policy.

6.3 Legal Requirements and Law Enforcement

We may disclose your personal information when we believe in good faith that such disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or governmental request
• Enforce our Terms of Service or other agreements
• Protect the rights, property, or safety of Dave's Hot Chicken, our customers, employees, or the public
• Detect, prevent, or address fraud, security incidents, or technical issues
• Respond to an emergency that poses a threat to the life, health, or safety of any individual

6.4 With Your Consent

We may share your information with third parties not described above when we have obtained your explicit consent to do so. You may withdraw your consent at any time by contacting us at [email protected].

7. Data Security

We take the security of your personal information seriously and implement a range of technical, administrative, and physical safeguards designed to protect your data from unauthorized access, use, disclosure, alteration, or destruction. Our security measures include:

• Encryption: We use Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption to protect data transmitted between your browser and our website. Sensitive data such as payment information is encrypted both in transit and at rest.
• Access Controls: Access to personal information is restricted to authorized employees and service providers who require it to perform their job functions. We enforce role-based access controls and principle of least privilege.
• Secure Payment Processing: We do not store full payment card numbers on our servers. All payment transactions are handled by PCI-DSS compliant third-party payment processors.
• Regular Security Assessments: We periodically review and update our security practices, conduct vulnerability assessments, and monitor our systems for suspicious activity.
• Employee Training: Our team members receive training on data protection best practices and our internal privacy policies.
• Incident Response: We maintain a data breach response plan and will notify affected individuals and relevant authorities as required by applicable law in the event of a security breach.

Despite these measures, no method of data transmission or storage over the internet is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

8. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze website traffic, and deliver personalized content and advertising. Cookies are small text files placed on your device when you visit our website.

8.1 Types of Cookies We Use

• Essential Cookies: Necessary for the basic functioning of our website, including maintaining your session, enabling shopping cart functionality, and ensuring security. These cookies cannot be disabled without significantly affecting website performance.
• Analytics Cookies: Used to collect information about how visitors interact with our website, such as pages visited, time spent, and links clicked. This data helps us improve our website and services. We use tools such as Google Analytics for this purpose.
• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your language preferences, saved addresses, or previously ordered items.
• Marketing and Advertising Cookies: Used to track your browsing activity across websites and deliver targeted advertisements relevant to your interests. These may be set by us or by third-party advertising partners.

8.2 Managing Your Cookie Preferences

You can manage your cookie preferences through your browser settings, which allow you to accept, reject, or delete cookies. Please note that disabling certain cookies may affect the functionality and performance of our website. Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies if you prefer.

For more detailed information about the cookies we use, the purposes for which we use them, and how you can manage your preferences, please refer to our Cookie Policy.

9. Your Privacy Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information. We are committed to honoring these rights in accordance with applicable United States privacy laws.

9.1 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose what personal information we have collected about you, including the categories of personal information, the sources from which it was collected, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Access: You have the right to request a copy of the specific pieces of personal information we have collected about you in the preceding 12 months.
• Right to Deletion: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (e.g., information needed to complete a transaction, comply with a legal obligation, or for security purposes).
• Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising purposes. To exercise this right, please contact us at [email protected].
• Right to Limit Use of Sensitive Personal Information: If we collect sensitive personal information as defined by CPRA, you have the right to direct us to limit its use to what is necessary to provide the services you have requested.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, provide a different level of quality, or suggest that you will receive a different price or quality because you exercised your privacy rights.

9.2 Rights for Residents of Other States

Residents of states including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws may have similar rights, including:

• Right to access personal data we hold about you
• Right to correct inaccurate personal data
• Right to delete personal data provided by or obtained about you
• Right to data portability — obtaining a copy of your data in a portable format
• Right to opt out of targeted advertising, the sale of personal data, and certain profiling activities
• Right to appeal our decision if we decline to take action on your request

9.3 General Rights for All Users

• Right to Withdraw Consent: Where we process your data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to Object to Marketing: You may opt out of direct marketing communications at any time as described in Section 4.4.
• Right to Data Portability: Where technically feasible and applicable, you may request a copy of your personal data in a structured, commonly used, machine-readable format.

9.4 How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable request by:

• Emailing us at: [email protected]

We will respond to verifiable requests within 45 days of receipt. If we require additional time (up to 90 days total), we will inform you of the extension and the reason for it. We may need to verify your identity before processing your request. We will not charge a fee for processing your request unless it is excessive, repetitive, or manifestly unfounded.

You may designate an authorized agent to submit requests on your behalf. We will require written proof of the agent's authorization and may verify your identity directly before processing the request.

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention periods we apply are as follows:

When personal information is no longer required, we will securely delete, anonymize, or destroy it in accordance with our internal data disposal procedures. In some cases, we may retain anonymized or aggregated data that does not identify you for statistical or research purposes indefinitely.

11. Children's Privacy

Our website and services are intended for use by individuals who are 18 years of age or older. We do not knowingly collect, solicit, or process personal information from children under the age of 13, and we do not direct our services to children.

If you are a parent or guardian and believe that your child under the age of 13 has provided us with personal information without your consent, please contact us immediately at [email protected]. We will take prompt steps to investigate the matter and delete any such information from our records.

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly engage in the collection of personal information from children under 13. Individuals between the ages of 13 and 17 should obtain parental or guardian consent before using our services or submitting any personal information.

We reserve the right to restrict access to our website and services to individuals who cannot confirm they are of legal age as required in their jurisdiction.

12. International Data Transfers

Dave's Hot Chicken is based in the United States and your personal information is collected, stored, and processed primarily within the United States. The United States may not have the same data protection laws as the country in which you are located.

If you are accessing our website or services from outside the United States, please be aware that your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. By using our services, you consent to the transfer of your information to the United States and other countries, which may have different privacy laws than your country of residence.

We take steps to ensure that any international transfers of personal data are conducted in compliance with applicable law and that appropriate safeguards are in place to protect your information. These safeguards may include contractual protections with our service providers.

If you have concerns about cross-border data transfers, please contact us at [email protected].

13. Third-Party Links and Services

Our website may contain links to third-party websites, applications, or services, including social media platforms, delivery partners, and review platforms. These third-party services are operated independently and have their own privacy policies. We are not responsible for the content, privacy practices, or data handling of any third-party services, and we encourage you to read their privacy policies before providing any personal information to them.

The inclusion of a link to a third-party website does not constitute an endorsement of that website or its privacy practices by Dave's Hot Chicken.

14. Do Not Track Signals

Some web browsers allow you to send "Do Not Track" (DNT) signals to websites you visit. At this time, our website does not respond to DNT signals because there is no uniform standard for how such signals should be interpreted. However, you can manage your preferences regarding tracking technologies through our cookie management tools or your browser settings.

We will continue to monitor developments in DNT standards and update our practices accordingly.

15. How to File a Complaint

If you believe that we have not complied with our obligations under this Privacy Policy or applicable data protection laws, we encourage you to first contact us directly so we can attempt to resolve the matter promptly.

15.1 Contact Us Directly

Please send your complaint or concern to:

• Email: [email protected]
• Website: daveshot-cafe.rest

We will acknowledge receipt of your complaint within 10 business days and aim to resolve it within 45 business days. If you are not satisfied with our response, you may escalate your complaint to the relevant authority.

15.2 Regulatory Authorities

Depending on your location, you may have the right to file a complaint with a government authority:

• California Residents: You may file a complaint with the California Privacy Protection Agency (CPPA) at cppa.ca.gov, or with the California Attorney General's Office at oag.ca.gov.
• All U.S. Residents: You may file a complaint regarding unfair or deceptive data practices with the Federal Trade Commission (FTC) at reportfraud.ftc.gov or by calling 1-877-FTC-HELP (1-877-382-4357).
• Virginia Residents: You may contact the Virginia Attorney General's Office at oag.state.va.us.
• Colorado Residents: You may contact the Colorado Attorney General's Office at coag.gov.

16. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make changes, we will revise the "Last Updated" date at the top of this page.

For material changes that significantly affect your rights or how we use your personal information, we will provide more prominent notice, which may include:

• A notice posted prominently on our website homepage
• An email notification sent to the address associated with your account
• An in-app notification if applicable

Your continued use of our website or services after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the changes, you should discontinue use of our services and contact us to request deletion of your personal information.

17. Contact Information for Privacy Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us. We are committed to addressing your inquiries promptly and transparently.

We will make every effort to respond to privacy-related inquiries within 45 days of receipt. For California residents exercising rights under the CCPA/CPRA, we will respond within the timeframes mandated by applicable law.